vulnerability-assessment

Vulnerability Assessment Skill

Use when assessing security posture. Scans dependencies, code, and configuration for vulnerabilities. Produces prioritised remediation plan.

When to Activate

• User asks to "check security", "find vulnerabilities", or "audit for risks"
• The /scan command is invoked
• User asks "is this code secure?" or "what are the security risks?"

Process

1. Identify the attack surface. What is exposed?

   • Public endpoints (APIs, web pages, webhooks)
   • Authentication boundaries (login flows, API keys, tokens)
   • Data entry points (forms, file uploads, URL parameters)
   • Third-party integrations (payment processors, auth providers, APIs)
   • Infrastructure (containers, servers, cloud services)

2. Scan each layer.

   Dependencies:

   • Parse lock files for exact versions
   • Cross-reference against vulnerability databases
   • Identify transitive dependencies (the dependency's dependencies)
   • Note which vulnerabilities are actually reachable in your code

   Application code:

   • Review for OWASP Top 10 patterns
   • Check input validation coverage
   • Verify authentication and authorisation logic
   • Inspect cryptographic usage
   • Look for information leakage in errors and logs

   Configuration:

   • Check for secure defaults
   • Verify secrets management
   • Inspect network exposure
   • Review container security settings

3. Score and prioritise. For each finding:

   • Assign CVSS score based on attack vector, complexity, privileges required, user interaction, scope, and impact
   • Assess exploitability in the specific context (is the vulnerable code path reachable?)
   • Consider blast radius (what else is affected if this is exploited?)

4. Produce remediation plan. Ordered by priority:

# Remediation Plan

## Immediate (Critical — fix today)
1. [Finding] — [Fix description] — [Effort estimate]

## This Week (High)
1. [Finding] — [Fix description] — [Effort estimate]

## This Sprint (Medium)
1. [Finding] — [Fix description] — [Effort estimate]

## Backlog (Low)
1. [Finding] — [Fix description] — [Effort estimate]